cbcvebase.
CVE-2024-50368
published 2024-11-26

CVE-2024-50368: A CWE-78 "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" was discovered affecting the following devices…

PriorityP347high7.2CVSS 3.1
AVNACLPRHUINSUCHIHAH
EPSS
1.04%
59.8th percentile
A CWE-78 "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" was discovered affecting the following devices manufactured by Advantech: EKI-6333AC-2G (<= 1.6.3), EKI-6333AC-2GD (<= v1.6.3) and EKI-6333AC-1GPO (<= v1.2.1). The source of the vulnerability relies on multiple parameters belonging to the "basic_htm" API which are not properly sanitized before being concatenated to OS level commands.

Affected

21 ranges
VendorProductVersion rangeFixed in
advantecheki-6333ac-1gpo<= <= 1.2.1—
advantecheki-6333ac-1gpo_firmware< 1.2.21.2.2
advantecheki-6333ac-2g<= <= 1.6.3—
advantecheki-6333ac-2g_firmware< 1.6.51.6.5
advantecheki-6333ac-2gd<= <= 1.6.3—
advantecheki-6333ac-2gd_firmware< 1.6.51.6.5
msrcwindows_10——
msrcwindows_10_version_1607——
msrcwindows_10_version_1809——
msrcwindows_10_version_21h2——
msrcwindows_10_version_22h2——
msrcwindows_11_version_21h2——
msrcwindows_11_version_22h2——
msrcwindows_11_version_23h2——
msrcwindows_server_2008——
msrcwindows_server_2008_r2——
msrcwindows_server_2012——
msrcwindows_server_2012_r2——
msrcwindows_server_2016——
msrcwindows_server_2019——
msrcwindows_server_2022——

CVSS provenance

nvdv3.17.2HIGHCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
vendor_msrc6.7MEDIUM
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.